On the second question.
If you jpg is coming as part of http traffic, you can find all
instances of it by putting image-jfif (or image-gif) in the display
filter box.
Then, for each entry scroll down in the headers until the find the
image dissector's section (most probably the set of fields at the real
bottom, under HTTP). When you click on that, it selects the bytes for
that image. Once the bytes are selected, you can export the selected
range (from File/export menu) and it will be your image.
Of course, if your HTTP traffic is not on port 80, you need to 'decode
as' your port traffic as HTTP. You will also need to enable options
for HTTP and TCP to alllow reassembling the packets (basically, tick
all options under TCP and HTTP protocols).
Of course, it is a fairly manual process comparing to what I see
Effetech provides, but it is there.
Hope this helps,
Alex.
On Mon, 21 Mar 2005 12:14:56 -0500, mail.panino@xxxxxxxx
<mail.panino@xxxxxxxx> wrote:
>
>
> Hey guys,
>
> I need some help.
>
> (2) Can Ethereal capture .jpgs, banners usw. like the effetech http sniffer
> (effetech.com). I know how capture URLS, but i don´t know how capture jpgs,
> banners.
> Therefore I will capture the search words in google. How can I do this?
>
> Thanks!
